Privacy Policy

1. Introduction

Thep Legal ("we", "us", "our") is committed to protecting the personal data you share with us. This policy explains what information we collect, why we collect it, how we use it, and what rights you have in relation to it.

This policy applies to all personal data we handle in connection with our legal services, our website, and communications. It is written in accordance with Thailand's Personal Data Protection Act B.E. 2562 (2019) (PDPA).

For questions about this policy, contact us at [email protected].

2. Data we collect

We collect personal data that you provide directly, including:

• Name, email address, and phone number submitted via contact forms
• Information shared during consultations, in correspondence, and through our services
• Technical data including IP address, browser type, and page visit data (via cookies and analytics tools)

We also hold the information you share with us in the course of providing legal services. This information is subject to legal professional privilege and strict internal confidentiality controls.

Legal basis for processing (under PDPA):

• — Contract: to provide the legal services you have engaged us for
• — Legitimate interests: to respond to enquiries and improve our services
• — Consent: for optional communications and analytics cookies
• — Legal obligation: where law requires us to retain records

Retention: Contact form data is retained for up to 24 months. Client matter files are retained for 7 years from matter close, as required by professional conduct rules. Analytics data is retained for 14 months.

3. How we use your data

We use personal data to respond to enquiries, provide legal services, and communicate about your matter. Specifically:

• Responding to contact form submissions and email enquiries
• Preparing documents, correspondence, and filings on your behalf
• Sending written summaries and updates related to your matter
• Maintaining records as required by professional rules and Thai law
• Analysing website usage to improve our content (analytics, with consent)

We do not sell personal data to third parties. We do not use your data for automated decision-making or profiling.

Third parties: We may share data with court registries and counterparty representatives in the course of legal proceedings, as required by law or with your consent. We use analytics tools (such as Google Analytics, subject to your cookie consent) to understand how our website is used. These providers process data on our behalf under data processing agreements.

4. Data protection measures

We take the security of personal data seriously. Our measures include:

• Encrypted storage for digital client files, access restricted by role
• Locked physical storage for paper documents
• All staff bound by confidentiality obligations exceeding legal minimums
• Annual review of security and data handling practices
• Breach notification procedures in place; we will notify you and the PDPC in accordance with PDPA requirements if a breach occurs

5. Cookies

Our website uses cookies to function and to understand how visitors use it. Essential cookies are always active. Analytics and preference cookies are optional and subject to your consent.

For full details, please see our Cookie Policy.

6. Your rights

Under Thailand's Personal Data Protection Act, you have the following rights in relation to your personal data:

• Access: request a copy of the personal data we hold about you
• Rectification: ask us to correct inaccurate or incomplete data
• Erasure: request deletion of data we no longer have grounds to hold
• Portability: receive a copy of your data in a structured, readable format
• Objection: object to processing based on legitimate interests
• Withdrawal of consent: withdraw consent at any time where processing is based on consent

To exercise these rights, contact us at [email protected]. We will respond within 30 days.

You have the right to lodge a complaint with Thailand's Personal Data Protection Committee (PDPC) if you believe we have not handled your data correctly.

7. Third-party links

Our website may contain links to external sites. We are not responsible for the privacy practices of those sites. We encourage you to read their privacy policies before sharing any personal data.

8. Children's privacy

Our services are directed at adults. We do not knowingly collect personal data from individuals under 18. If you believe we hold data relating to a minor, please contact us at [email protected] so we can address this promptly.

9. Changes to this policy

We review this policy annually and update it when our practices or the law requires. Changes will be posted on this page with a revised "Last updated" date. Continued use of our website following any update constitutes acceptance of the revised policy.

10. Contact

Thep Legal is the data controller for personal data processed in connection with our legal services and website.